Privacy Policy
Last updated: March 2026
This Privacy Policy describes how CANNEVO processes personal data in the context of the CANNEVO platform.
Controller
The data controller for the CANNEVO platform is the entity that has entered into a service agreement with CANNEVO for operation of a cannabis social club management system.
Data We Process
Platform operators (superadmin users)
- Email address and authentication credentials
- Multi-factor authentication device references
- Audit log entries (actions taken within the platform)
Club staff (admin portal users)
- Email address and authentication credentials
- Role assignment records
- Audit log entries
Club members
- Identity data as required for club membership and §26 KCanG compliance
- Monthly dispensing records (pseudonymised for statutory reporting)
- DSAR request records if applicable
Legal Basis
| Processing Activity | Legal Basis |
|---|---|
| Club membership management | Art. 6(1)(b) GDPR — performance of contract |
| §26 KCanG compliance records | Art. 6(1)(c) GDPR — legal obligation |
| Platform security & audit logs | Art. 6(1)(f) GDPR — legitimate interests |
| DSAR processing | Art. 6(1)(c) GDPR — legal obligation (Art. 12 GDPR) |
Retention
Data is retained only as long as necessary for the purpose for which it was collected, or as required by law. §26 KCanG sets specific minimum retention periods for cultivation and dispensing records.
Your Rights
You have the right to access, correct, delete, restrict, and port your personal data. To exercise your rights, contact the data controller (your club's designated Data Protection contact).
Contact
For data protection enquiries related to the CANNEVO platform, contact the CANNEVO Data Protection Officer at the address provided in your service agreement.